Verify every handoff in an alert-triggered Network Watcher capture

Source facts

Microsoft’s proactive packet-capture example chains a VM alert to an Azure function. The function processes the alert and starts a Network Watcher capture, which collects VM traffic and uploads the capture file to storage. The source also describes capture filters and storage on either a blob or the guest machine. Microsoft Learn.

Applicability

Use this review for an approved diagnostic-automation design. Identify the alert, function, target VM, capture filter, destination and access owner. Review authentication and data-handling requirements independently; the source’s credential example is one implementation, not a blanket recommendation for a production identity design.

DSE recommendation

DSE recommends separate acceptance evidence for alert delivery, function execution, capture creation and usable output. Scope the capture to the diagnostic question and agree on authorized traffic, duration and storage handling before activation. Define what operators should do if an alert arrives but a later handoff fails.

Verification

Trigger a harmless approved test condition and trace its timestamp through each component. Inspect the resulting file for the expected target and test traffic, then confirm authorized reviewers can retrieve it. Record failures at their actual stage. Keep packet contents and credentials out of ordinary tickets, and apply the agreed retention handling after the exercise.

Official references

Microsoft Learn: Use Packet Capture to Proactively Monitor Your Network.